AZ-104 Manage Azure Identities and Governance Practice Question
Three Azure virtual machines in different resource groups must all use the same Azure identity to access a storage account. The identity should keep working even if one VM is rebuilt. What should you use?
⚠ Common exam trap
It's easy for candidates to confuse system-assigned managed identities (which are tied to a single VM's lifecycle) with user-assigned managed identities (which are independent resources), leading them to choose option A because they think 'each VM needs its own identity' rather than a shared, persistent one.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A user-assigned managed identity
A user-assigned managed identity is created as a standalone Azure resource and can be assigned to multiple VMs, even across resource groups. It persists independently of any VM lifecycle, so rebuilding a VM does not affect the identity's availability or its permissions to access the storage account.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A system-assigned managed identity on each VM
Why it's wrong here
A system-assigned managed identity is created for and tied to a single VM's lifecycle: when the VM is deleted, the identity is automatically deleted as well. Because each VM has its own distinct system-assigned identity, the three VMs would have three different security principals in Azure AD, not a shared identity. This means you would have to assign permissions to each identity separately, and any VM rebuild or replacement would require re-creating the identity and re-assigning role assignments. For a group of VMs that need to act as the same identity, a user-assigned managed identity is the correct choice.
When this WOULD be correct
When a single VM needs to access Azure resources without managing credentials, and the identity should be automatically removed when the VM is deleted. For example, a VM running a custom application that only needs access to a key vault.
- ✓
A user-assigned managed identity
Why this is correct
A user-assigned managed identity is a standalone Azure resource that can be attached to multiple VMs. Because it is not tied to one VM’s lifecycle, it continues to exist even if a VM is rebuilt or replaced. This makes it the best choice when several compute resources need to share the same identity for Azure access. It also simplifies permission management because you grant access once to the shared identity.
- ✗
A shared VM administrator password
Why it's wrong here
A shared VM administrator password is simply the local or domain credential used to sign in to the VM's operating system (via RDP or SSH). It does not provide any identity in Azure AD nor does it grant permissions to Azure Resource Manager or Azure services. Sharing a password across three VMs is also a serious security anti-pattern: it increases the blast radius of credential compromise and makes rotation nearly impossible without disrupting all VMs. Even if each VM used the same password, that password would not enable the VMs to authenticate to Azure resources like storage or Key Vault.
When this WOULD be correct
A question that asks for a method to allow multiple administrators to remotely access VMs using the same credentials, with the requirement that the credentials remain valid after VM reimaging, would make a shared password correct if stored securely and reapplied via automation.
- ✗
A storage account SAS token
Why it's wrong here
A storage account SAS token is a delegation mechanism that grants scoped, time-limited access to specific storage resources (containers, blobs, queues, or tables) via a signed URL. It is not an identity; it cannot be used to authenticate to Azure Active Directory or to access other services like Key Vault or SQL Database. Moreover, SAS tokens expire and must be rotated, making them unsuitable as a persistent shared identity for three VMs that need consistent Azure access. Even if refreshed, the token authorizes only storage operations, not the full set of Azure RBAC-based permissions that a managed identity provides.
When this WOULD be correct
You need to grant a third-party application temporary, restricted access to a specific blob in your storage account without sharing your storage account key. The application does not require an Azure identity, and access should expire after a set time.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A user-assigned managed identityCorrect answer▾
Why this is correct
A user-assigned managed identity is a standalone Azure resource that can be attached to multiple VMs. Because it is not tied to one VM’s lifecycle, it continues to exist even if a VM is rebuilt or replaced. This makes it the best choice when several compute resources need to share the same identity for Azure access. It also simplifies permission management because you grant access once to the shared identity.
✗A system-assigned managed identity on each VMWrong answer — click to see why▾
Why this is wrong here
A system-assigned managed identity is tied to the lifecycle of each VM; if a VM is rebuilt, its identity is recreated and loses the previous role assignment, so it cannot be shared across VMs.
★ When this WOULD be the correct answer
When a single VM needs to access Azure resources without managing credentials, and the identity should be automatically removed when the VM is deleted. For example, a VM running a custom application that only needs access to a key vault.
Why candidates choose this
Candidates may think system-assigned managed identities are simpler to configure and assume they can be shared, not realizing they are per-resource and not persistent across VM rebuilds.
✗A shared VM administrator passwordWrong answer — click to see why▾
Why this is wrong here
A shared VM administrator password provides access to the VM itself, not to Azure resources like a storage account, and does not persist across VM rebuilds because the password would need to be reconfigured.
★ When this WOULD be the correct answer
A question that asks for a method to allow multiple administrators to remotely access VMs using the same credentials, with the requirement that the credentials remain valid after VM reimaging, would make a shared password correct if stored securely and reapplied via automation.
Why candidates choose this
Candidates may confuse VM-level authentication with Azure resource authentication, thinking that a shared password can be used to access storage accounts via the VM, or they may overlook the requirement for the identity to survive VM rebuilds.
✗A storage account SAS tokenWrong answer — click to see why▾
Why this is wrong here
A SAS token provides time-limited, delegated access to a specific storage account or resource, but it is not tied to an Azure identity and would need to be securely distributed and rotated. If a VM is rebuilt, the SAS token would still work if stored externally, but the requirement is for all VMs to use the same Azure identity, which a SAS token does not provide.
★ When this WOULD be the correct answer
You need to grant a third-party application temporary, restricted access to a specific blob in your storage account without sharing your storage account key. The application does not require an Azure identity, and access should expire after a set time.
Why candidates choose this
Candidates may think a SAS token is a simple way to grant access to storage without managing identities, and they might overlook the requirement for a persistent Azure identity that survives VM rebuilds.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Storage account
A cloud storage account is a container that holds a set of cloud storage services and their data, providing a unique namespace and access policies for storing and managing unstructured data.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.